CVE-2026-115289
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Nov 3, 2026
CISA due date
—
The record
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114643 The MongoDB C# Driver writes GeoJSON extra members without checking whether their names… CWE-694
- CVE-2026-57024 A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon… CWE-694
- CVE-2026-5794 A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to… CWE-694
- GHSA-xh5w-g8gq-r3v9 Keylime allows users to register new agents by recycling existing UUIDs when using… CWE-694
- CVE-2025-13609 A vulnerability has been identified in keylime where an attacker can exploit this flaw by… CWE-694